loopwn 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- loopwn-0.1.0/LICENSE +21 -0
- loopwn-0.1.0/PKG-INFO +57 -0
- loopwn-0.1.0/README.md +32 -0
- loopwn-0.1.0/loopwn/__init__.py +3 -0
- loopwn-0.1.0/loopwn/looplibc.py +71 -0
- loopwn-0.1.0/loopwn.egg-info/PKG-INFO +57 -0
- loopwn-0.1.0/loopwn.egg-info/SOURCES.txt +10 -0
- loopwn-0.1.0/loopwn.egg-info/dependency_links.txt +1 -0
- loopwn-0.1.0/loopwn.egg-info/requires.txt +1 -0
- loopwn-0.1.0/loopwn.egg-info/top_level.txt +1 -0
- loopwn-0.1.0/setup.cfg +4 -0
- loopwn-0.1.0/setup.py +25 -0
loopwn-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2024 Your Name
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
loopwn-0.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: loopwn
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: A CTF pwn helper library for easy libc address calculation
|
|
5
|
+
Home-page: https://github.com/loophatch/loopwn
|
|
6
|
+
Author: loophatch
|
|
7
|
+
Author-email: loophatch@example.com
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Requires-Python: >=3.6
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
License-File: LICENSE
|
|
14
|
+
Requires-Dist: pwntools
|
|
15
|
+
Dynamic: author
|
|
16
|
+
Dynamic: author-email
|
|
17
|
+
Dynamic: classifier
|
|
18
|
+
Dynamic: description
|
|
19
|
+
Dynamic: description-content-type
|
|
20
|
+
Dynamic: home-page
|
|
21
|
+
Dynamic: license-file
|
|
22
|
+
Dynamic: requires-dist
|
|
23
|
+
Dynamic: requires-python
|
|
24
|
+
Dynamic: summary
|
|
25
|
+
|
|
26
|
+
# loopwn
|
|
27
|
+
|
|
28
|
+
A Python library designed to assist with CTF Pwn challenges, specifically focusing on Libc address calculation and leak exploitation.
|
|
29
|
+
|
|
30
|
+
## Installation
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
pip install loopwn
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## Usage
|
|
37
|
+
|
|
38
|
+
```python
|
|
39
|
+
from loopwn import Looplibc
|
|
40
|
+
|
|
41
|
+
# Example 1: Initialize with a known base address
|
|
42
|
+
libc = Looplibc('./libc.so.6', 0x7ffff7a0d000)
|
|
43
|
+
|
|
44
|
+
# Example 2: Initialize with a leaked symbol address
|
|
45
|
+
# This will automatically calculate the base address
|
|
46
|
+
libc = Looplibc('./libc.so.6', 'puts', 0x7ffff7a8c5a0)
|
|
47
|
+
|
|
48
|
+
# Access addresses
|
|
49
|
+
print(hex(libc.system))
|
|
50
|
+
print(hex(libc.bin_sh))
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
## Features
|
|
54
|
+
|
|
55
|
+
- **Automatic Base Calculation**: Easily calculate libc base address from a leaked symbol.
|
|
56
|
+
- **Quick Access**: Get `system` and `/bin/sh` addresses via properties.
|
|
57
|
+
- **Pwntools Integration**: Inherits from `pwntools`'s `ELF` class.
|
loopwn-0.1.0/README.md
ADDED
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
# loopwn
|
|
2
|
+
|
|
3
|
+
A Python library designed to assist with CTF Pwn challenges, specifically focusing on Libc address calculation and leak exploitation.
|
|
4
|
+
|
|
5
|
+
## Installation
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
pip install loopwn
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Usage
|
|
12
|
+
|
|
13
|
+
```python
|
|
14
|
+
from loopwn import Looplibc
|
|
15
|
+
|
|
16
|
+
# Example 1: Initialize with a known base address
|
|
17
|
+
libc = Looplibc('./libc.so.6', 0x7ffff7a0d000)
|
|
18
|
+
|
|
19
|
+
# Example 2: Initialize with a leaked symbol address
|
|
20
|
+
# This will automatically calculate the base address
|
|
21
|
+
libc = Looplibc('./libc.so.6', 'puts', 0x7ffff7a8c5a0)
|
|
22
|
+
|
|
23
|
+
# Access addresses
|
|
24
|
+
print(hex(libc.system))
|
|
25
|
+
print(hex(libc.bin_sh))
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
## Features
|
|
29
|
+
|
|
30
|
+
- **Automatic Base Calculation**: Easily calculate libc base address from a leaked symbol.
|
|
31
|
+
- **Quick Access**: Get `system` and `/bin/sh` addresses via properties.
|
|
32
|
+
- **Pwntools Integration**: Inherits from `pwntools`'s `ELF` class.
|
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
from pwn import *
|
|
2
|
+
|
|
3
|
+
class LoopSearch(ELF):
|
|
4
|
+
def __init__(self,path):
|
|
5
|
+
'''
|
|
6
|
+
初始化libc对象
|
|
7
|
+
'''
|
|
8
|
+
super().__init__(path, checksec=False)
|
|
9
|
+
'''
|
|
10
|
+
使用checksec关闭安全检查输出
|
|
11
|
+
'''
|
|
12
|
+
def set_base(self,address):
|
|
13
|
+
'''
|
|
14
|
+
设置Libc的基地址
|
|
15
|
+
设置完之后,就可以使用.sym['xxx']进行计算
|
|
16
|
+
'''
|
|
17
|
+
self.address = address
|
|
18
|
+
@property
|
|
19
|
+
def system(self):
|
|
20
|
+
'''
|
|
21
|
+
获取libc 的system 函数的真实地址
|
|
22
|
+
'''
|
|
23
|
+
return self.symbols['system']
|
|
24
|
+
@property
|
|
25
|
+
def bin_sh(self):
|
|
26
|
+
"""
|
|
27
|
+
获取 /bin/sh 字符串的真实地址
|
|
28
|
+
"""
|
|
29
|
+
results = list(self.search(b'/bin/sh'))
|
|
30
|
+
if results:
|
|
31
|
+
return results[0]
|
|
32
|
+
return None
|
|
33
|
+
# 将迭代器转为列表,如果列表非空则取第一个,否则返回 None
|
|
34
|
+
|
|
35
|
+
class Looplibc(LoopSearch):
|
|
36
|
+
def __init__(self, path, *args):
|
|
37
|
+
"""
|
|
38
|
+
初始化并立即显示关键信息。
|
|
39
|
+
:param path: Libc 文件路径 (str)
|
|
40
|
+
:param args:
|
|
41
|
+
- 如果只有 1 个参数,则视为基址 (int)
|
|
42
|
+
- 如果有 2 个参数,则视为 (symbol_name, leaked_addr)
|
|
43
|
+
"""
|
|
44
|
+
super().__init__(path)
|
|
45
|
+
|
|
46
|
+
# 参数解析
|
|
47
|
+
if len(args) == 1:
|
|
48
|
+
# 模式 1: 直接传入基址
|
|
49
|
+
self.address = args[0]
|
|
50
|
+
elif len(args) == 2:
|
|
51
|
+
# 模式 2: 传入符号名和泄露地址,自动倒推基址
|
|
52
|
+
sym_name, leak_addr = args
|
|
53
|
+
if sym_name not in self.symbols:
|
|
54
|
+
raise ValueError(f"Symbol '{sym_name}' not found in {path}")
|
|
55
|
+
|
|
56
|
+
offset = self.symbols[sym_name]
|
|
57
|
+
self.address = leak_addr - offset
|
|
58
|
+
print(f"[*] Calculated Base from '{sym_name}': {hex(leak_addr)} - {hex(offset)} = {hex(self.address)}")
|
|
59
|
+
else:
|
|
60
|
+
raise ValueError("Invalid arguments. Usage: loolibc(path, base) OR looplibc(path, sym_name, leak_addr)")
|
|
61
|
+
|
|
62
|
+
print(f"\n{'=' * 30}")
|
|
63
|
+
print(f"[*] Libc Base: {hex(self.address)}")
|
|
64
|
+
print(f"[+] System Address: {hex(self.system)}")
|
|
65
|
+
|
|
66
|
+
bin_sh = self.bin_sh
|
|
67
|
+
if bin_sh:
|
|
68
|
+
print(f"[+] /bin/sh Address: {hex(bin_sh)}")
|
|
69
|
+
else:
|
|
70
|
+
print("[-] /bin/sh not found.")
|
|
71
|
+
print(f"{'=' * 30}\n")
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: loopwn
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: A CTF pwn helper library for easy libc address calculation
|
|
5
|
+
Home-page: https://github.com/loophatch/loopwn
|
|
6
|
+
Author: loophatch
|
|
7
|
+
Author-email: loophatch@example.com
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Requires-Python: >=3.6
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
License-File: LICENSE
|
|
14
|
+
Requires-Dist: pwntools
|
|
15
|
+
Dynamic: author
|
|
16
|
+
Dynamic: author-email
|
|
17
|
+
Dynamic: classifier
|
|
18
|
+
Dynamic: description
|
|
19
|
+
Dynamic: description-content-type
|
|
20
|
+
Dynamic: home-page
|
|
21
|
+
Dynamic: license-file
|
|
22
|
+
Dynamic: requires-dist
|
|
23
|
+
Dynamic: requires-python
|
|
24
|
+
Dynamic: summary
|
|
25
|
+
|
|
26
|
+
# loopwn
|
|
27
|
+
|
|
28
|
+
A Python library designed to assist with CTF Pwn challenges, specifically focusing on Libc address calculation and leak exploitation.
|
|
29
|
+
|
|
30
|
+
## Installation
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
pip install loopwn
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## Usage
|
|
37
|
+
|
|
38
|
+
```python
|
|
39
|
+
from loopwn import Looplibc
|
|
40
|
+
|
|
41
|
+
# Example 1: Initialize with a known base address
|
|
42
|
+
libc = Looplibc('./libc.so.6', 0x7ffff7a0d000)
|
|
43
|
+
|
|
44
|
+
# Example 2: Initialize with a leaked symbol address
|
|
45
|
+
# This will automatically calculate the base address
|
|
46
|
+
libc = Looplibc('./libc.so.6', 'puts', 0x7ffff7a8c5a0)
|
|
47
|
+
|
|
48
|
+
# Access addresses
|
|
49
|
+
print(hex(libc.system))
|
|
50
|
+
print(hex(libc.bin_sh))
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
## Features
|
|
54
|
+
|
|
55
|
+
- **Automatic Base Calculation**: Easily calculate libc base address from a leaked symbol.
|
|
56
|
+
- **Quick Access**: Get `system` and `/bin/sh` addresses via properties.
|
|
57
|
+
- **Pwntools Integration**: Inherits from `pwntools`'s `ELF` class.
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
pwntools
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
loopwn
|
loopwn-0.1.0/setup.cfg
ADDED
loopwn-0.1.0/setup.py
ADDED
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
from setuptools import setup, find_packages
|
|
2
|
+
|
|
3
|
+
with open("README.md", "r", encoding="utf-8") as fh:
|
|
4
|
+
long_description = fh.read()
|
|
5
|
+
|
|
6
|
+
setup(
|
|
7
|
+
name="loopwn",
|
|
8
|
+
version="0.1.0",
|
|
9
|
+
author="loophatch", # 作者名
|
|
10
|
+
author_email="loophatch@example.com", # 建议修改为你的真实邮箱
|
|
11
|
+
description="A CTF pwn helper library for easy libc address calculation",
|
|
12
|
+
long_description=long_description,
|
|
13
|
+
long_description_content_type="text/markdown",
|
|
14
|
+
url="https://github.com/loophatch/loopwn", # 项目主页
|
|
15
|
+
packages=find_packages(),
|
|
16
|
+
classifiers=[
|
|
17
|
+
"Programming Language :: Python :: 3",
|
|
18
|
+
"License :: OSI Approved :: MIT License",
|
|
19
|
+
"Operating System :: OS Independent",
|
|
20
|
+
],
|
|
21
|
+
python_requires='>=3.6',
|
|
22
|
+
install_requires=[
|
|
23
|
+
'pwntools',
|
|
24
|
+
],
|
|
25
|
+
)
|